Reference mikrotik crs328

MikroTik CRS328-24P-4S+RM, RouterOS v7.19.6 (stable), ARM. Identity set to forge-rack-switch 2026-06-12.

Management IPs (since 2026-06-12): - 192.168.86.215 on the main LAN via DHCP client on bridge (GFiber lease, can drift until reserved in Fiber app). Reachable natively from Console. NOTE: releasing this lease while connected to it cuts your own session; use the 192.168.88.1 fallback for DHCP-client surgery. - 192.168.88.1/24 static on bridge remains as fallback. To reach it from Console: sudo ip addr add 192.168.88.100/24 dev ens18 (temp alias, remove after).

Credentials: ~/.forge-secrets/mikrotik-crs328.env. The 2026-05-26 custom password STOPPED WORKING by 2026-06-12 (SSH host key also changed; unit evidently factory-reset at some point, possibly the 2026-06-12 hard power cut). Current working password is the factory sticker password (sticker on top of unit). Rotate to a strong alphanumeric-only password when convenient (old one had $, which risks shell-sourcing mangling).

API access: port 8728, plaintext /login with name+password (RouterOS v7). Working Python socket client in session 2026-06-12 (length-prefixed words protocol).

Services open: SSH(22), Telnet(23), HTTP(80), Winbox(8291), API(8728), API-SSL(8729).

Bridge: factory default, all 28 ports including sfp-sfpplus1-4 ARE in the bridge (earlier note claiming SFP+ excluded was wrong or pre-reset). Topology facts (from bridge host table 2026-06-12): GFiber gateway reached via sfp-sfpplus3; Finn likely sfp-sfpplus2; ether6 has ~9 MACs (AP or secondary switch).

DHCP snooping ON (2026-06-12), sfp-sfpplus3 is the sole trusted port. Cause: the TP-Link AP on ether5 (MAC 50:3D:D1:15:5E:0A, SSID "Gus the Bass", installed for the Eight Sleep Pod) ran a rogue DHCP server at 192.168.0.254 handing out 192.168.0.x leases; it stranded ~23 Wi-Fi clients (Echos, Tapo, WiZ, Lutron bridge, Brother printer) starting ~2026-06-08 and blocked recovery after the 2026-06-12 power cycle. ether5 was disabled to kill it, then re-enabled once snooping was verified (broadcast-dhcp-discover sees only 192.168.86.1 offers). The AP itself was then factory-reset and rebuilt 2026-06-12 with DHCP server OFF and mgmt at 192.168.86.177 (creds in ~/.forge-secrets/tplink.env), so both layers now hold. When adding a new uplink or a legit DHCP server port, set trusted=yes on that bridge port or DHCP breaks.

PoE port mapping (confirmed 2026-05-26): - ether19: side_light camera, powered-on, 4W - ether20: back_yard camera, short-circuit (camera has separate power) - ether21: front_floodlight camera, powered-on, 6.1W - ether22: front_door camera, powered-on, 3.7W - ether2, ether8, ether20: short-circuit status (cable issues)

Tier-1 hardening applied 2026-06-12 (late session): telnet + ftp services disabled; port comments on ether5/6/19-22 + sfp-sfpplus2/3; loop-protect=on all 24 copper ports; broadcast storm control (limit-broadcasts, storm-rate 10%) all copper ports; SNMP enabled, community forge-ro (192.168.86.0/24 only, public disabled); NTP client on (time.google.com), tz America/Chicago. Nightly config export: scripts/forge_network_config_backup.sh (cron 04:10) to ~/.forge-secrets/network-configs/crs328-<date>.rsc, 30-day retention.

Companion AP (TL-WA801N "Gus The Bus" at 192.168.86.177, behind ether5): WPS disabled, channel fixed 11 @ 20MHz, ping-watchdog self-reboot (gateway 192.168.86.1, 60s interval, 5 fails), SNMP enabled community forge-ro. Driving its web UI: Playwright + page's own doSave() via JS (raw button clicks silently fail); creds ~/.forge-secrets/tplink.env.

Queued (not done): snmp_exporter wiring into the Prometheus stack (SNMP is live on both devices); GFiber DHCP reservations for .215 (switch) + .177 (AP); identify the 9-MAC device on ether6. No VLANs by design while GFiber is the only router. Full setup plan at [[mikrotik-crs328-initial-setup-2026-05-14]].